First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

The Time Constraint Check in makePrediction() Allows Betting at Thu Aug 15 2024 20:00:00 GMT+0000

0xsagetony

Summary

The makePrediction() function allows players to place bets on a specific game. According to the protocol's documentation, predictions can be made by any approved player until 19:00:00 UTC on the day of the match, which starts at 20:00:00 UTC. However, the current implementation makePrediction() permits players to place bets even after 19:00:00 UTC, violating the protocol's rules and undermining the game's integrity.

Vulnerability Details

According to the documentation, players are expected to place their bets on or before 19:00:00 UTC. However, due to an issue with the if statement check in makePrediction(), players are currently able to place bets after 19:00:00 UTC. This violates the protocol's rules and compromises the integrity of the game.

POC

function test_playersPreditAfterTheSpecifiedTime() public {
vm.startPrank(stranger);
vm.deal(stranger, 1 ether);
thePredicter.register{value: 0.04 ether}();
vm.stopPrank();
vm.startPrank(organizer);
thePredicter.approvePlayer(stranger);
vm.stopPrank();
​
vm.startPrank(stranger);
vm.warp(1723752000);
thePredicter.makePrediction{value: 0.0001 ether}(
1,
ScoreBoard.Result.Draw
);
vm.stopPrank();
}

Impact

  1. The ability to place bets after the cutoff time contradicts the documented rules, leading to inconsistencies and potential disputes.

  2. Players and stakeholders may lose trust in the system if it doesn't adhere to its stated rules, potentially damaging the reputation of the protocol.

  3. Allowing late bets undermines the fairness of the game, as players might exploit this loophole to make predictions based on last-minute information.

Tools Used

Manual

Recommendations

-- if (block.timestamp <= START_TIME + matchNumber * 68400 - 68400)

++ if (
block.timestamp <= (START_TIME + matchNumber * 68400 - 68400) - 3600
)

Updates

Lead Judging Commences

NightHawK Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Match timestamps are incorrect

In both contracts there is a similar error in the computation of the timestamps of the matches.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.